Personal Data Privacy
Read whole topic Back Print Forward

II. Consumer credit data (relating to records of any loan or credit provided by banks or financial institutions)

The Privacy Commissioner's Office first issued a Code of Practice on Consumer Credit Data under the Ordinance in February 1998. It was revised in April 2011 . Any breach of the Code may be used as evidence in any legal proceedings relating to the Ordinance against the relevant data user.

The Code governs the sharing and use of consumer credit data by credit providers (including banks and financial institutions but excluding persons who lend money to friends/relatives) through a credit reference agency ("CRA") . Under the Code, consumer credit data refer to personal data relating to an individual's consumer credit transactions collected by a credit provider in connection with the provision of consumer credit. Consumer credit generally means any loans, overdraft facilities or other kinds of credit provided by a credit provider to and for the use of an individual.

Credit providers, who subscribe to the service of a CRA, may provide consumer credit data to the CRA and in return obtain credit reports (see question 1 below) of individuals for credit checking and assessment purposes. For example, when you apply for a credit card, loan or overdraft facility, hire purchase or leasing arrangement with a bank, the bank may obtain a credit report about you from a CRA. The bank makes reference to information in your credit report to assess your credit worthiness and repayment ability. If you have been granted a loan or credit facility, the bank may report your credit data to the CRA. In the event of any default in repayment, the bank may pass your credit information to a debt collection agency for collection of payment (but not for other purposes), and may also report such data to the CRA.

  1. What information would be written on a credit report? How can I contact the credit reference agency ("CRA") to obtain my own credit report?
  2. What can I do if I find out that the information contained in my credit report is not accurate?
  3. Can credit providers obtain a credit report about me at anytime they want?
  4. Is there any information (about a borrower/debtor) that a credit provider must not report to a CRA?
  5. If I act as a guarantor for my friend's loan from a bank, will the bank disclose my role as a guarantor to a CRA? Does the Code also cover the scenario of an individual being the guarantor for a corporate loan?
  6. Is it compulsory for credit providers to provide all of an individual’s (borrower or guarantor) loan account information to a CRA?
  7. How long can a CRA retain my credit data? If I settle my loan account, will my credit data held by a CRA be deleted from its database?
  8. Is there any benefit to keeping my closed account data in the CRA's database?
  9. Suppose I had a tax loan with a bank that I fully repaid in January 2003 (before the effective date of the Code). I also have a credit card with the same bank for many years up to now. Can my bank provide data concerning all these accounts to the CRA after the Code has taken effect on 2 June 2003?
  10. If I declare bankruptcy, will my credit data held by a CRA be deleted from its database? What if I do not declare bankruptcy but have entered into an Individual Voluntary Arrangement (IVA, a debt repayment scheme recognized by the court) with my creditors?
  11. Are there any safeguards to protect my credit data against improper access by credit providers?
  12. What can I do if I find out that a credit provider or a CRA is not handling my data properly?
  13. Enquiry Case Notes from the PCO – Should the bank notify me (as the guarantor of a loan facility) if my credit report is accessed when (i) the loan facility is applied for; and (ii) when the existing loan facility is reviewed? What if I am the actual account holder instead?
  14. Enquiry Case Notes from the PCO – A bank has received a letter from a firm of solicitors acting for the administrator of the estate of a deceased person. The bank is requested to disclose certain records in relation to accounts which are in the name of the deceased. However the records also include information relating to third parties. Is such disclosure a contravention of the Ordinance?


The above questions and answers only highlight the general points of the Code. For further information, please refer to the whole content of the Code on the PCO webpage . It is recommended that you contact the PCO or consult a lawyer if you have any queries about the Code.